unit ufraRegMonitor;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, ComCtrls, uRegMonitorThread;

type
  TfraRegMonitor = class(TFrame)
    lvRegMonLog: TListView;
  private
    { Private declarations }
    RegMonitorThread : TRegMonitorThread;
  public
    { Public declarations }
   procedure WMREGCHANGE(var Msg : TMessage); message WM_REGCHANGE;

    CONSTRUCTOR Create(AOwner : TComponent); override;
    DESTRUCTOR Destroy(); override;

    FUNCTION AppHookFunc(Var Message : TMessage) : Boolean;

  end;

implementation
{$R *.dfm}

function TfraRegMonitor.AppHookFunc(var Message : TMessage) : Boolean;
begin
  Result := False; //I just do this by default
  if Message.Msg = WM_REGCHANGE then begin
  WMREGCHANGE(Message);
    Result := True;
  end;
end;

CONSTRUCTOR TfraRegMonitor.Create(AOwner: TComponent);
begin
  Inherited Create(AOwner);

  RegMonitorThread := TRegMonitorThread.Create;
    Application.HookMainWindow(AppHookFunc);

  with RegMonitorThread do
    Begin
      FreeOnTerminate := True;
      Wnd := Application.Handle;

      Key := 'Software\Microsoft';
      RootKey := HKEY_LOCAL_MACHINE;

      WatchSub := True;
      Start;
    End;

end;

DESTRUCTOR TfraRegMonitor.Destroy;
begin
   Application.UnHookMainWindow(AppHookFunc);
    RegMonitorThread.Terminate;
  Inherited Destroy();
end;

PROCEDURE TfraRegMonitor.WMREGCHANGE(Var Msg : TMessage);
Var
    Item        :     TListItem;
Begin
Item := Self.lvRegMonLog.Items.Add;

Item.Caption := 'Registry change at ' + DateTimeToStr(Now);
Item.SubItems.Add(IntToStr(RegMonitorThread.ChangeData.Rootkey) + ' - ' + RegMonitorThread.ChangeData.Key);
End;



end.
